Actually I double checked and the bogus registrations were among those making fake reviews. So it seems like they are getting around the registration necessary for reviews and registering first and reviewing next.

My product id 52 and 1352 are the only ones being spammed in the reviews.

I just installed reCAPTCHA for X-Cart Classic on my 4.6.6 Gold. I looked at the X-Cart Marketplace add-on, but I don't enable most of the forms it added reCaptcha to, and Phil's install for registrations and contactus was very easy, and worked immediately. I had been getting bogus registrations and contact us forms (5-10) daily for about 3 weeks.